PT-2026-53515 · Pypi · Octavia

Publicado 2026-06-29 · Atualizado 2026-06-29

OSV

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Amphora Images in OpenStack Octavia >=0.10.0 <2.1.2, >=3.0.0 <3.2.0, >=4.0.0 <4.1.0 allows anyone with access to the management network to bypass client-certificate based authentication and retrieve information or issue configuration commands via simple HTTP requests to the Agent on port https/9443, because the cmd/agent.py gunicorn cert reqs option is True but is supposed to be ssl.CERT REQUIRED.

Correção

Identificadores relacionados

PYSEC-2026-433

Produtos afetados

Octavia

Referências · 19

• https://github.com/openstack/octavia · Nota
• https://github.com/openstack/octavia/commit/b0c2cd7b4c835c391cfedf12cf9f9ff8a0aabd17 · Nota
• https://github.com/openstack/octavia/commit/c2fdffc3b748f8007c72e52df257e38756923b40 · Nota
• https://github.com/openstack/octavia/commit/89a2f6e0136ad49d928eb65b4cf555af2a2b8ab1 · Nota
• https://github.com/openstack/octavia/commit/624ff08f27bcb73788663cbe6d35cbe29c537844 · Nota
• https://github.com/openstack/octavia/commit/1725517d1d209f26b2275306d83e49c099dcbe1a · Nota
• https://github.com/openstack/octavia/commit/2976a7f0f109e17930db8a61136526ead44ea7e5 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-17134 · Nota de Segurança
• https://osv.dev/vulnerability/PYSEC-2026-433 · Aviso do Fabricante
• https://storyboard.openstack.org/#!/story/2006660 · Nota
• https://security.openstack.org/ossa/OSSA-2019-005.html · Nota
• https://review.opendev.org/686546 · Nota
• https://review.opendev.org/686547 · Nota
• https://review.opendev.org/686543 · Nota
• https://review.opendev.org/686545 · Nota